4 ms·
This is, of course, a vulnerability. But let's not get too crazy. Once you are applying a patch, either you trust the patch or not. If you blindly apply patche
by yiyus 9y ago
This is, of course, a vulnerability. But let's not get too crazy. Once you are applying a patch, either you trust the patch or not.
If you blindly apply patches, you will be in risk as soon as you run or try to compile the patched command. This attack is just a bit faster because it happens as soon as you apply the patch.
- schoen 9y agoSuppose you're applying patches to something other than software?
- 0x0 9y agoWhat if you're trying to apply a patch to a .txt document?
- mrob 9y agoPatch isn't only used for source code. I wouldn't have expected any risk of malicious code execution if I was patching documentation.
- jwilk 9y agoEven for source, you may want to review the patch after applying it. For example, dpkg-source applies patches when you unpack source package. I don't think anybody expects code execution when unpacking stuff, even when this stuff is untrusted.